Canadian Privacy Commissioner Opens Investigation into Cyberattacks on Canada Revenue Agency and other Federal Organizations

On October 13, 2020, the Office of the Privacy Commissioner of Canada (the OPC) announced it had launched investigations into recent cyber security incidents targeting Government of Canada organizations including the Canada Revenue Agency (as reported previously by the E-TIPS® Newsletter here).

The OPC opened two investigations addressing the security incidents. One will focus on cyberattacks on the GCKey, an electronic credential issued by the Canadian government to provide users access to online services, while the other will probe the cyberattacks on Canada Revenue Agency accounts.

The security incidents used a tactic called "credential stuffing", whereby cyberattackers use passwords and usernames from previous cyberattacks in an attempt to see whether individuals used the same username and password combinations for other accounts.

The investigations circle around whether the government institutions who fell victim to the security incidents met their obligations under the Privacy Act, Canada's public sector privacy law.

Summary By: Hashim Ghazi